CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2open() replay
A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit() fails before the next send, cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required, with no user interaction required. It is not rated as remotely exploitable through the network alone.
What conditions trigger the vulnerable path?
The issue requires an SMB2 open replay sequence in which a response-bearing attempt returns a replayable error and frees its response buffer, followed by an SMB2_open_init() failure before the next send. The stale response bookkeeping can then cause the same response to be freed again.
Which products are identified as affected?
The provided data identifies the Linux kernel and Microsoft azl3 kernel 6.6.144.1-1. No fixed version is specified in the provided information.